WordPress ShopMonitor.io plugin < 1.2.0 - Unauthenticated Administrator Account Takeover vulnerability

Unauthenticated Administrator Account Takeover vulnerability discovered by Pedro Pinho in WordPress Plugin ShopMonitor.io versions 1.2.0...

WordPress DynamicKit for Elementor plugin < 1.0.3 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Pedro Pinho in WordPress Plugin DynamicKit for Elementor versions 1.0.3...

WordPress User Profile Builder plugin < 3.16.4 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Jakub Herman in WordPress Plugin Profile Builder versions 3.16.4...

WordPress Essential Addons for Elementor plugin < 6.7.2 - Unauthenticated Privilege Escalation via Custom Profile Field Mass Assignment vulnerability

Unauthenticated Privilege Escalation via Custom Profile Field Mass Assignment vulnerability discovered by Jakub Herman in WordPress Plugin Essential Addons for Elementor versions 6.7.2...

WordPress ProSolution WP Client plugin <= 2.0.8 - Unauthenticated Arbitrary File Deletion via 'newfilename' and 'filename' Parameters vulnerability

Unauthenticated Arbitrary File Deletion via 'newfilename' and 'filename' Parameters vulnerability discovered by CHOIGYEONGMIN in WordPress Plugin ProSolution WP Client versions = 2.0.8...

WordPress ProSolution WP Client plugin <= 2.0.10 - Unauthenticated Arbitrary File Upload via Content-Disposition Header Filename Override vulnerability

Unauthenticated Arbitrary File Upload via Content-Disposition Header Filename Override vulnerability discovered by Nir Yehoshua - cipher security labs in WordPress Plugin ProSolution WP Client versions = 2.0.10...

WordPress SVG Support plugin < 2.5.17 - Author+ Stored XSS via .svgz Sanitization Bypass vulnerability

Author+ Stored XSS via .svgz Sanitization Bypass vulnerability discovered by Shivamani Vastrala in WordPress Plugin SVG Support versions 2.5.17...

WordPress Eventin plugin < 4.1.20 - Editor+ Local File Inclusion via speaker_template Setting vulnerability

Editor+ Local File Inclusion via speakertemplate Setting vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin WP Event SOlution versions 4.1.20...

WordPress Nexter Blocks plugin < 5.0.2 - Author+ Stored XSS via SVG Upload vulnerability

Author+ Stored XSS via SVG Upload vulnerability discovered by Bob Matyas in WordPress Plugin Nexter Blocks versions 5.0.2...

WordPress GeoDirectory plugin < 2.8.110 - Editor+ Stored XSS via Place Categories vulnerability

Editor+ Stored XSS via Place Categories vulnerability discovered by Krugov Artyom in WordPress Plugin GeoDirectory versions 2.8.110...

WordPress YITH WooCommerce Membership Premium plugin <= 2.33.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by dutafi in WordPress Plugin YITH WooCommerce Membership Premium versions = 2.33.0...

WordPress Templatiq plugin <= 0.2.5 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by daroo in WordPress Plugin Templatiq versions = 0.2.5...

WordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Nabil Irawan in WordPress Plugin PDF Smart Viewer for Elementor versions = 1.0.4...

WordPress Online Contact Widget plugin <= 1.3.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin Online Contact Widget versions = 1.3.0...

WordPress Duitku Payment Gateway plugin <= 2.11.14 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by daroo in WordPress Plugin Duitku Payment Gateway versions = 2.11.14...

WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Jakub Herman in WordPress Plugin Restaurant Menu by MotoPress versions = 2.4.11...

WordPress Autopay plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by ParkHyunWoo in WordPress Plugin Autopay versions = 5.0.0...

WordPress WPDM – Premium Packages plugin <= 7.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Evan NR in WordPress Plugin WPDM – Premium Packages versions = 7.0.5...

WordPress MultiVendorX plugin <= 5.0.14 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Jakub Herman in WordPress Plugin MultiVendorX versions = 5.0.14...

WordPress Flutterwave WooCommerce plugin <= 3.3.0 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Jakub Herman in WordPress Plugin Flutterwave WooCommerce versions = 3.3.0...

WordPress Piraeus Bank WooCommerce Payment Gateway plugin 3.2.0 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Jakub Herman in WordPress Plugin Piraeus Bank WooCommerce Payment Gateway versions 3.2.0...

WordPress JetAppointment plugin <= 2.5.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by dutafi in WordPress Plugin JetAppointment versions = 2.5.2...

WordPress Readabler plugin < 2.0.18 - SQL Injection vulnerability

SQL Injection vulnerability discovered by dutafi in WordPress Plugin Readabler versions 2.0.18...

WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Jakub Herman in WordPress Plugin Booking calendar, Appointment Booking System versions = 3.2.36...

WordPress Masteriyo - LMS plugin <= 2.3.2 - Arbitrary File Upload vulnerability

WordPress Masteriyo - LMS plugin = 2.3.2 - Arbitrary File Upload vulnerability discovered by 20kilograma in WordPress Plugin Masteriyo - LMS versions = 2.3.2...

WordPress Contact Form by Supsystic plugin < 1.10.0 - Bypass Vulnerability vulnerability

Bypass Vulnerability vulnerability discovered by Asim Alshaya in WordPress Plugin Contact Form by Supsystic versions 1.10.0...

WordPress Contact Form by Supsystic plugin < 1.10.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Asim Alshaya in WordPress Plugin Contact Form by Supsystic versions 1.10.0...

WordPress License Manager for WooCommerce plugin <= 3.0.18 - SQL Injection vulnerability

SQL Injection vulnerability discovered by rootdirective.sec in WordPress Plugin License Manager for WooCommerce versions = 3.0.18...

WordPress Youzify plugin <= 1.3.7 - Deserialization of untrusted data vulnerability

Deserialization of untrusted data vulnerability discovered by Peter Thaleikis in WordPress Plugin Youzify versions = 1.3.7...

WordPress Fluent Forms Pro Add On Pack plugin < 6.2.12 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Fluent Forms Pro Add On Pack versions 6.2.12...

WordPress Contact Form, Survey, Quiz & Popup Form Builder - ARForms plugin <= 1.8.5 - Unauthenticated PHP Object Injection vulnerability

WordPress Contact Form, Survey, Quiz & Popup Form Builder - ARForms plugin = 1.8.5 - Unauthenticated PHP Object Injection vulnerability discovered by Krzysztof Zając - CERT PL in WordPress Plugin ARForms Form Builder versions = 1.8.5...

WordPress OptionTree plugin <= 2.7.3 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin OptionTree versions = 2.7.3...

WordPress Kirki plugin <= 6.1.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameter vulnerability

Missing Authorization to Authenticated Subscriber+ Sensitive Information Disclosure via 'context' Parameter vulnerability discovered by Datist Pham - NAB Innovation Centre Vietnam in WordPress Plugin Kirki versions = 6.1.1...

WordPress Ultimate Dashboard Pro plugin <= 3.11.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Ultimate Dashboard Pro versions = 3.11.2...

WordPress Ultimate Dashboard plugin <= 3.11.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Ultimate Dashboard versions = 3.11.2...

WordPress Depicter Slider plugin <= 4.8.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Peng Zhou in WordPress Plugin Depicter Slider versions = 4.8.0...

WordPress Kirki plugin <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter vulnerability

Authenticated Editor+ Path Traversal to Arbitrary File Read via 'data' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Kirki versions = 6.1.1...

WordPress Gallery by BestWebSoft plugin <= 4.7.9 - Authenticated (Editor+) SQL Injection via Gallery Image Order Array Keys vulnerability

Authenticated Editor+ SQL Injection via Gallery Image Order Array Keys vulnerability discovered by Farrukh Ziyaev in WordPress Plugin Gallery versions = 4.7.9...

WordPress Forminator Forms plugin <= 1.55.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter vulnerability

Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter vulnerability discovered by se1en in WordPress Plugin Forminator versions = 1.55.0.2...

WordPress Bold Page Builder plugin <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin Bold Page Builder versions = 5.6.8...

WordPress WP Compress plugin <= 7.10.09 - Cross-Site Request Forgery to Arbitrary Options Deletion vulnerability

Cross-Site Request Forgery to Arbitrary Options Deletion vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin WP Compress versions = 7.10.09...

WordPress WCPOS plugin <= 1.9.14 - Authenticated (Shop Manager+) Code Injection via 'thermal' Template Engine vulnerability

Authenticated Shop Manager+ Code Injection via 'thermal' Template Engine vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin WooCommerce POS versions = 1.9.14...

WordPress Video Gallery plugin <= 4.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment 'post_title' via emd_mb_meta Shortcode vulnerability

Authenticated Author+ Stored Cross-Site Scripting via Attachment 'posttitle' via emdmbmeta Shortcode vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin YouTube Showcase versions = 4.0.4...

WordPress WC Vendors plugin <= 2.7.0 - Authenticated (Shop Manager+) SQL Injection via 'status' Parameter vulnerability

Authenticated Shop Manager+ SQL Injection via 'status' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin WC Vendors Marketplace versions = 2.7.0...

WordPress Turnkey bbPress by WeaverTheme plugin <= 1.7.1 - Authenticated (Administrator+) PHP Object Injection vulnerability

Authenticated Administrator+ PHP Object Injection vulnerability discovered by Luk6785 in WordPress Plugin Turnkey bbPress versions = 1.7.1...

WordPress User Login History plugin <= 2.1.7 - Authenticated (Administrator+) SQL Injection via 'blog_id' Parameter vulnerability

Authenticated Administrator+ SQL Injection via 'blogid' Parameter vulnerability discovered by Nikola Kojic - RAS-IT in WordPress Plugin User Login History versions = 2.1.7...

WordPress Toocheke Companion plugin <= 2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'series_bg_color' Post Meta vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'seriesbgcolor' Post Meta vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Toocheke Companion versions = 2.10...

WordPress SureDash plugin <= 1.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'draweropenverposition' Block/Shortcode Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'draweropenverposition' Block/Shortcode Attribute vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin SureDash versions = 1.10.3...

WordPress Snippet Shortcodes plugin <= 5.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode Attributes vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Snippet Shortcodes versions = 5.2.0...

WordPress Smash Balloon Social Post Feed plugin <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'id' Shortcode Attribute vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Smash Balloon Social Post Feed versions = 4.9.0...